phpMyAdmin before 2.9.1-rc1 has a libraries directory under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via direct requests for certain files.

This patch upgrades the phpMyAdmin package to version 2.9.1.1, including fixes for the security problems tracked by the Mitre CVE IDs CVE-2006-3388, CVE-2006-5116, CVE-2006-5117, and CVE-2006-5718.

The remote host is running phpMyAdmin, a web interface for administering MySQL database servers.  This version of phpMyAdmin is vulnerable to an HTML injection attack as well as several undisclosed vulnerabilities.  The details of the flaws will be released by the vendor; however, they have released a patched version of phpMyAdmin. 

phpMyAdmin team reports :

We received a security advisory from Stefan Esser (sesser@hardened-php.net) and we wish to thank him for his work.

It was possible to inject arbitrary SQL commands by forcing an authenticated user to follow a crafted link.

Versions of phpMyAdmin prior to 2.9.1-rc1 are affected by the following vulnerabilities :

 - A series of cross-site request forgery (CSRF) flaws that allow remote attackers to perform unauthorized actions as another user. Specifically, this flaw affects the files 'libraries/common.lib.php', 'session.inc.php', and 'url_generating.lib.php' and is leveraged by (1) directly setting a token in the URL though dynamic variable evaluation and (2) unsetting arbitrary variables via the '_REQUEST' array. (CVE-2006-5116)
 - Insufficient access control in the phpMyAdmin libraries directory under the web root. Exploiting this flaw would allow a remote attacker to obtain sensitive information via direct requests for certain files. (CVE-2006-5117)

ID	Name	Product	Family	Severity
27395	openSUSE 10 Security Update : phpMyAdmin (phpMyAdmin-2300)	Nessus	SuSE Local Security Checks	medium
3882	PHPMyAdmin < 2.9.2-rc2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
22487	FreeBSD : phpmyadmin -- CSRF vulnerabilities (19b17ab4-51e0-11db-a5ae-00508d6a62df)	Nessus	FreeBSD Local Security Checks	medium
3756	phpMyAdmin < 2.9.1-rc1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2006-5117

high

Tenable Plugins

medium

medium

medium

medium